CVE-2014-6037

Related Files

ManageEngine Eventlog Analyzer Arbitrary File Upload

Posted Sep 12, 2014

Authored by h0ng10 | Site metasploit.com

This Metasploit module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer. The vulnerability exists in the agentUpload servlet which accepts unauthenticated file uploads and handles zip file contents in a insecure way. By combining both weaknesses a remote attacker can achieve remote code execution. This Metasploit module has been tested successfully on versions v7.0 - v9.9 b9002 in Windows and Linux. Versions between 7.0 and < 8.1 are only exploitable via EAR deployment in the JBoss server, while versions 8.1+ are only exploitable via a JSP upload.

tags | exploit, remote, code execution, file upload

systems | linux, windows

advisories | CVE-2014-6037

SHA-256 | 7a0773137d222dd2f47bbc5c83d57f0b5cff637f5610d1a372378c64bc78f404

Download | Favorite | View

ManageEngine EventLog Analyzer 9.9 Authorization / Code Execution

Posted Sep 1, 2014

Authored by Hans-Martin Muench

ManageEngine EventLog Analyzer version 9.9 suffers from unauthenticated remote code execution via shell upload and authorization vulnerabilities.

tags | exploit, remote, shell, vulnerability, code execution

advisories | CVE-2014-6037

SHA-256 | a0c98cac5f5fd141c8b87fb1b8f63391779ddd21923531556150cd799b862ef7

Download | Favorite | View